# Tutorial: Ops exports & compliance aids

Produce AI governance, regulatory-clock drafts, FAIR/CCM mappings, Threat Radar
queries, and trial PoV summaries from Ops: all with non-claim footers.

**Time:** ~20-30 minutes  
**Plane:** Ops management

## Prerequisites

- Ops GUI with auth; scope `intelligence:read` on `$OPS_TOKEN`
- Familiarity with [phase4-investigate-federation.md](phase4-investigate-federation.md)

## 1. Export AI Risk Governance Pack

```bash
curl -sS -H "Authorization: Bearer $OPS_TOKEN" \
  http://127.0.0.1:8080/api/export/aigov | jq .non_claim_footer
```

Confirm the footer states mapping-only / no EU AI Act conformity claim.

## 2. Regulatory Clock draft (no auto-file)

```bash
curl -sS -H "Authorization: Bearer $OPS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"kind":"draft","draft_id":"draft-eu-72h","jurisdiction":"EU","notification_clock_hours":72,"triggers":["personal_data_breach_suspected"]}' \
  http://127.0.0.1:8080/api/export/regclock | jq '{auto_file:.auto_file,status:.draft.status}'
```

`auto_file` must be `false`. Operators remain responsible for jurisdiction clocks.

## 3. CCM mapping payload

```bash
curl -sS -H "Authorization: Bearer $OPS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"kind":"ccm","provider":"drata","control_id":"CCM-DECOY-1","status":"mapped","evidence_refs":["docs/how-to/ops-exports.md"]}' \
  http://127.0.0.1:8080/api/export/compliance | jq .ccm.mutates_customer_control
```

Expect `false`.

## 4. Threat Radar stub

```bash
curl -sS -H "Authorization: Bearer $OPS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"api_key":"lab-key","opt_in_public":true,"jurisdiction":"GLOBAL_PUBLIC"}' \
  http://127.0.0.1:8080/api/export/threat-radar
```

Re-identifying `client_hint` values (IPs, usernames) are rejected. Methodology:
[threat-radar-methodology.md](../reference/threat-radar-methodology.md).

## 5. Trial PoV summary

```bash
curl -sS -H "Authorization: Bearer $OPS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"trial_id":"trial-lab-1","sensor_nodes":2,"listeners":["ssh","http"]}' \
  http://127.0.0.1:8080/api/export/pov | jq .summary.ops_required
```

Expect `false` (engine-only PoC path).

## Next

- Procedures: [ops-exports.md](../how-to/ops-exports.md)
- Governance pack prose: [ai-risk-governance/](../governance/ai-risk-governance/README.md)
- Phase 5 SSO / dual-key: [phase5-enterprise-sso.md](phase5-enterprise-sso.md)